Denial of service (DoS) and distributed denial of service (DDoS) attacks relate generally to malicious attempts to disrupt and/or halt the services of a network host that is connected to the Internet. A DoS attack is typically carried out by a single person or system whereas a DDoS attack is carried out by two or more people or multiple systems. There are many types of attacks that may affect a network host's performance. Volume-based attacks seek to consume the bandwidth of the targeted server, overloading the server and disrupting service to legitimate users trying to access the server. Protocol attacks seek to consume actual server resources as well as those of communication equipment in order to disrupt legitimate traffic. Application layer attacks target and disrupt specific weak spots in the server. The overarching goal of these attacks is to crash or flood a targeted server in order to prevent legitimate users of a server from accessing the server. Traditional anti-DDoS and hacking protection methods include the use of a hardware or software firewall that is designed to reduce malicious activity at the targeted server or network. However, while a firewall is effective against small amounts of malicious activity, firewalls are vulnerable to large amounts of malicious activity such as DDoS attacks that are capable of overloading the Internet connection to the servers. Another method is to utilize a network of servers between users and a destination server. The network of servers hides the destination server from users while any malicious activity is sent through the network of servers, rather than to the targeted destination server. Malicious data is removed via a “scrubbing center” while normal data is permitted to continue to the destination server. However, the use of a scrubbing center to remove malicious data causes data performance to suffer due to the significant amount of latency that is added when data is sent to a scrubbing center. Additionally, it is not possible to select the data that is processed at the scrubbing center and all traffic to the destination server must be processed before continuing to the destination server. The present invention seeks to address the aforementioned issues relating to DoS and DDoS security as well as enhance and improve upon conventional methods of security against malicious attacks.
The present invention is a method for protecting a server from DoS and DDoS attacks as well as other forms of malicious activity such as hacking. In the preferred embodiment of the present invention, the system and method are designed to hide an Internet-based server from a user. A custom proxy client is utilized to connect the user to an Internet-based server that the user wishes to access. Major technical details of the Internet-based server such as the domain name and Internet Protocol (IP) address of the server are hidden from the user. The user is connected to a global network of proxy servers through the proxy, henceforth referred to as a global private network (GPN). The GPN serves to effectively hide the location and IP address of the Internet-based server from the user attempting to access the server. The user is connected to an edge server that is located in close proximity to his or her computer. The IP address of the edge server may be known to the user. User data is then transferred from the edge server to one or more unknown GPN servers before being transferred to the destination Internet-based server. During this process, only the IP address of the edge server is known to the user. Edge servers are vulnerable to malicious attack and are considered to be expendable and as such, attacks on edge servers are not problematic.
Data flow through the GPN is optimized in order to ensure that latency, flux, and spikes and loss remain low. Data is processed in order to determine if the data is latency-sensitive, non-latency sensitive, or may be excluded from rerouting. If latency-sensitive data is sent from an originating computer, the data is rerouted through the GPN in a manner such that the data is sent through multiple low latency servers within the GPN for as long as possible. The data is then transferred to the destination server in order to avoid unreliable performance often characteristic of internet service provider (ISP) servers and routers. Non-latency sensitive data is transferred through multiple high bandwidth servers within the GPN prior to being transferred to the destination server. Data that has been excluded from rerouting is transferred directly to the destination server, bypassing the GPN entirely.